Researchers Create Mac "Firmworm" That Spreads Via Thunderbolt Ethernet Adapters

BIOS4breakfast writes: Wired reports that later this week at BlackHat and Defcon, Trammell Hudson will show the Thunderstrike 2 update to his Thunderstrike attack on Mac firmware (previously covered on Slashdot). Trammell teamed up with Xeno Kovah and Corey Kallenberg from LegbaCore, who have previously shown numerous exploits for PC firmware. They found multiple vulnerabilities that were already publicly disclosed were still present in Mac firmware. This allows a remote attacker to break into the Mac over the network, and infect its firmware. The infected firmware can then infect Apple Thunderbolt to Ethernet adapters' PCI Option ROM. And then those adapters can infect the firmware of any Mac they are plugged into — hence creating the self-propagating Thunderstrike 2 "firmworm." Unlike worms like Stuxnet, it never exists on the filesystem, it only ever lives in firmware (which no one ever checks.) A video showing the proof of concept attack is posted on YouTube.

Comments

Re: In other words...

[John Allsup]

One idiot to get the thunderbolt adapter infected, then passing round the adapter will spread infections. I recall corporate it being paranoid about plugging things into usb, this paranoia is getting more and more justifiable. Option rom stuff and dma need to be hardware sandboxed, but too few modern buyers are discerning enough for it to be worth the r and d.